WEBVTT

1
00:00.000 --> 00:00.473 align:middle line:84%


2
00:00.473 --> 00:02.140 align:middle line:90%
In this video, I'd
like to chat with you

3
00:02.140 --> 00:04.750 align:middle line:90%
about private VLANs
integrated with trunking

4
00:04.750 --> 00:06.590 align:middle line:84%
between two switches.

5
00:06.590 --> 00:08.470 align:middle line:90%
So let's imagine that
this is switch one

6
00:08.470 --> 00:11.380 align:middle line:90%
that we configured and verified
in our previous videos,

7
00:11.380 --> 00:13.360 align:middle line:90%
and that we have
a trunk on 0 slash

8
00:13.360 --> 00:16.660 align:middle line:84%
0 that goes over to switch 2.

9
00:16.660 --> 00:19.030 align:middle line:90%
Now, if we have
traffic that is sent,

10
00:19.030 --> 00:23.710 align:middle line:90%
let's say a broadcast is sent
from this device in VLAN 200,

11
00:23.710 --> 00:25.960 align:middle line:90%
that broadcast is
going to be seen

12
00:25.960 --> 00:29.140 align:middle line:90%
by other ports in that
same secondary VLAN,

13
00:29.140 --> 00:31.990 align:middle line:90%
and it's also going to be seen
by the promiscuous port, which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.140 --> 00:31.990 align:middle line:90%
and it's also going to be seen
by the promiscuous port, which

14
00:31.990 --> 00:34.330 align:middle line:90%
is handy if we want things
like default gateways

15
00:34.330 --> 00:35.840 align:middle line:84%
to respond to us and so forth.

16
00:35.840 --> 00:38.830 align:middle line:90%
And in addition to the
devices here in that same VLAN

17
00:38.830 --> 00:40.900 align:middle line:90%
and the promiscuous
port, the broadcast

18
00:40.900 --> 00:43.875 align:middle line:90%
is also going to be sent
over any trunks associated

19
00:43.875 --> 00:44.500 align:middle line:84%
with that VLAN.

20
00:44.500 --> 00:48.490 align:middle line:90%
So on the trunk, it would look
like a broadcast source from

21
00:48.490 --> 00:53.260 align:middle line:90%
this device which on the 802.1Q
trunk is going to be tagged

22
00:53.260 --> 00:54.710 align:middle line:84%
with VLAN 200.

23
00:54.710 --> 00:57.610 align:middle line:90%
So if this trunk is carrying
VLAN 200 traffic, when

24
00:57.610 --> 01:01.780 align:middle line:90%
switch 2 sees it, it just
sees a broadcast for VLAN 200.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:57.610 --> 01:01.780 align:middle line:90%
switch 2 sees it, it just
sees a broadcast for VLAN 200.

25
01:01.780 --> 01:03.050 align:middle line:84%
So what does that mean?

26
01:03.050 --> 01:06.370 align:middle line:90%
Well, if we don't want VLAN
200 to be seen over here

27
01:06.370 --> 01:09.022 align:middle line:90%
on switch 2, we could
eliminate it or remove it

28
01:09.022 --> 01:11.230 align:middle line:90%
from the trunk, and that
way that broadcast can never

29
01:11.230 --> 01:11.730 align:middle line:84%
make it.

30
01:11.730 --> 01:13.870 align:middle line:90%
But the broadcast does
go over the trunk,

31
01:13.870 --> 01:16.450 align:middle line:90%
and there is a
VLAN 200 over here,

32
01:16.450 --> 01:18.080 align:middle line:84%
what's switch 2 going to do?

33
01:18.080 --> 01:20.600 align:middle line:90%
It's just going to forward it
to all the other ports in VLAN

34
01:20.600 --> 01:21.100 align:middle line:84%
200.

35
01:21.100 --> 01:25.090 align:middle line:90%
And if switch 2 is not
using private VLANs,

36
01:25.090 --> 01:27.430 align:middle line:90%
it won't know anything
about security measures

37
01:27.430 --> 01:28.660 align:middle line:84%
that switch 1 was taking.

38
01:28.660 --> 01:30.370 align:middle line:90%
It's just going to
forward that broadcast
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.660 --> 01:30.370 align:middle line:90%
It's just going to
forward that broadcast

39
01:30.370 --> 01:32.827 align:middle line:90%
to all other ports in VLAN
200 and be done with it.

40
01:32.827 --> 01:34.660 align:middle line:90%
So I wanted you to be
aware of the trunking,

41
01:34.660 --> 01:36.760 align:middle line:90%
and also that switch
2, by default,

42
01:36.760 --> 01:39.190 align:middle line:90%
is not going to know
anything about our isolation

43
01:39.190 --> 01:41.470 align:middle line:90%
that we're trying to set
up over here on switch 1.

44
01:41.470 --> 01:44.500 align:middle line:90%
Now, what we could do is we
could implement private VLANs

45
01:44.500 --> 01:46.960 align:middle line:90%
in the same structure
over here on switch 2.

46
01:46.960 --> 01:48.790 align:middle line:90%
And if we did so,
and a broadcast

47
01:48.790 --> 01:52.220 align:middle line:90%
was sent sourced from VLAN 200,
when it's received over here,

48
01:52.220 --> 01:55.900 align:middle line:90%
it would only be sent to the
devices in the secondary VLAN

49
01:55.900 --> 01:59.470 align:middle line:90%
of 200, which also would be
configured as a type community.

50
01:59.470 --> 02:03.190 align:middle line:90%
So devices over here in
the secondary VLAN of 200
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:59.470 --> 02:03.190 align:middle line:90%
So devices over here in
the secondary VLAN of 200

51
02:03.190 --> 02:05.470 align:middle line:90%
would be able to communicate
with devices over here

52
02:05.470 --> 02:07.423 align:middle line:90%
in the secondary
VLAN of 200 as well.

53
02:07.423 --> 02:09.340 align:middle line:90%
So I thought for fun,
here's what we could do.

54
02:09.340 --> 02:12.340 align:middle line:90%
I've configured private VLANs
just as we did over here

55
02:12.340 --> 02:14.140 align:middle line:84%
on switch 1 on switch 2.

56
02:14.140 --> 02:16.270 align:middle line:90%
And as a test what
should be able to happen

57
02:16.270 --> 02:21.010 align:middle line:90%
is, if we connected this roamer
into a port that is associated

58
02:21.010 --> 02:24.610 align:middle line:90%
with VLAN 200, it should
be able to communicate

59
02:24.610 --> 02:28.330 align:middle line:90%
with devices over here in
that same secondary VLAN.

60
02:28.330 --> 02:32.890 align:middle line:90%
Or if we connected it to VLAN
300 over here on switch 2,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:28.330 --> 02:32.890 align:middle line:90%
Or if we connected it to VLAN
300 over here on switch 2,

61
02:32.890 --> 02:35.200 align:middle line:90%
it should be able to
communicate with other devices

62
02:35.200 --> 02:38.740 align:middle line:90%
in that same VLAN 300
over here on switch 1.

63
02:38.740 --> 02:40.780 align:middle line:90%
And if we put it in
the isolated port

64
02:40.780 --> 02:43.540 align:middle line:90%
it shouldn't be able
to talk to anybody.

65
02:43.540 --> 02:45.340 align:middle line:90%
Not over here, not
here, not here.

66
02:45.340 --> 02:47.800 align:middle line:90%
Because if it's an
isolated secondary VLAN,

67
02:47.800 --> 02:50.260 align:middle line:90%
his port is isolated, and
he's not talking to anybody

68
02:50.260 --> 02:51.882 align:middle line:84%
except for a promiscuous port.

69
02:51.882 --> 02:53.590 align:middle line:90%
So as a test, here's
what I'd like to do.

70
02:53.590 --> 02:56.500 align:middle line:90%
Let's connect this guy
over to, let's go ahead

71
02:56.500 --> 03:01.750 align:middle line:90%
and use gig 1 slash 1,
which is part of VLAN 300,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:56.500 --> 03:01.750 align:middle line:90%
and use gig 1 slash 1,
which is part of VLAN 300,

72
03:01.750 --> 03:04.780 align:middle line:90%
because I basically replicated
the private VLAN configuration

73
03:04.780 --> 03:07.180 align:middle line:90%
we had on switch 1, and
I replicated it over here

74
03:07.180 --> 03:07.960 align:middle line:84%
on switch 2.

75
03:07.960 --> 03:11.500 align:middle line:90%
Now, the trunk is nothing
more than a standard 802.1 Q

76
03:11.500 --> 03:14.530 align:middle line:90%
trunk that's connecting these
two switches together carrying

77
03:14.530 --> 03:15.190 align:middle line:84%
all the VLANs.

78
03:15.190 --> 03:18.400 align:middle line:90%
It doesn't have any private
VLAN specific information

79
03:18.400 --> 03:19.650 align:middle line:84%
configured on the trunks.

80
03:19.650 --> 03:21.400 align:middle line:90%
So let's go ahead and
connect this guy up,

81
03:21.400 --> 03:23.020 align:middle line:90%
get him an IP
address, and verify

82
03:23.020 --> 03:25.570 align:middle line:90%
that this roamer,
as part of VLAN 300

83
03:25.570 --> 03:27.760 align:middle line:90%
in the private VLANs
configured on switch 2,

84
03:27.760 --> 03:30.190 align:middle line:90%
that it should be able to
communicate with the IP address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:27.760 --> 03:30.190 align:middle line:90%
that it should be able to
communicate with the IP address

85
03:30.190 --> 03:32.973 align:middle line:90%
associated with 300
dash 1 and 300 dash 2.

86
03:32.973 --> 03:35.140 align:middle line:90%
So while we're here, let's
go ahead and connect him.

87
03:35.140 --> 03:39.628 align:middle line:90%
So I just drag him over, and we
want to put him on port gig 1

88
03:39.628 --> 03:41.032 align:middle line:84%
slash 1.

89
03:41.032 --> 03:44.140 align:middle line:90%
Let's also, just for grins,
verify that port 1 slash 1

90
03:44.140 --> 03:48.040 align:middle line:90%
really is associated with
the secondary VLAN of 300

91
03:48.040 --> 03:48.970 align:middle line:84%
on switch 2.

92
03:48.970 --> 03:51.470 align:middle line:90%
So there's our console message
saying the interface came up.

93
03:51.470 --> 03:52.262 align:middle line:84%
That's a good sign.

94
03:52.262 --> 03:55.600 align:middle line:90%
Let's do a show
VLAN, private VLAN.

95
03:55.600 --> 03:57.730 align:middle line:90%
All right, so, right
there gig 1 slash

96
03:57.730 --> 03:59.650 align:middle line:90%
1, where we just
connected to that PC,

97
03:59.650 --> 04:01.880 align:middle line:90%
is associated with
a secondary VLAN
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
03:59.650 --> 04:01.880 align:middle line:90%
is associated with
a secondary VLAN

98
04:01.880 --> 04:04.420 align:middle line:84%
300, which is a type community.

99
04:04.420 --> 04:05.282 align:middle line:84%
Fantastic start.

100
04:05.282 --> 04:07.240 align:middle line:90%
Let's go ahead and bring
up a console interface

101
04:07.240 --> 04:08.590 align:middle line:84%
to our roamer PC.

102
04:08.590 --> 04:10.450 align:middle line:84%
So here is our roamer.

103
04:10.450 --> 04:13.690 align:middle line:90%
Now because I have a trunk
all the way over to switch 1,

104
04:13.690 --> 04:15.100 align:middle line:84%
in fact, let's do this.

105
04:15.100 --> 04:19.820 align:middle line:90%
On switch 2, let me just
verify that we have a trunk.

106
04:19.820 --> 04:20.589 align:middle line:84%
And we do.

107
04:20.589 --> 04:24.700 align:middle line:90%
So gig 0/0 is a trunk, and all
the VLANs are being allowed.

108
04:24.700 --> 04:25.840 align:middle line:84%
That's a great start.

109
04:25.840 --> 04:30.880 align:middle line:90%
And let's go to the virtual PC,
and let's go ahead and IP DHCP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:25.840 --> 04:30.880 align:middle line:90%
And let's go to the virtual PC,
and let's go ahead and IP DHCP.

110
04:30.880 --> 04:33.490 align:middle line:90%
So this DDORA process
for DHCP, it's

111
04:33.490 --> 04:34.963 align:middle line:90%
getting IP address
over the trunk.

112
04:34.963 --> 04:37.630 align:middle line:90%
In fact, what I'd like to do is,
let me capture all the traffic,

113
04:37.630 --> 04:40.130 align:middle line:90%
start a capture, and we
can see it in action.

114
04:40.130 --> 04:44.320 align:middle line:90%
So we'll go back to switch 2,
right click, click on Capture,

115
04:44.320 --> 04:46.900 align:middle line:90%
and then we want to
capture in gig 0 slash 0

116
04:46.900 --> 04:48.760 align:middle line:90%
that traffic goes
across the trunk.

117
04:48.760 --> 04:51.610 align:middle line:90%
So I'll specify we're
looking for ethernet traffic

118
04:51.610 --> 04:53.530 align:middle line:84%
as far as the encapsulation.

119
04:53.530 --> 04:55.540 align:middle line:84%
Let me bring that full screen.

120
04:55.540 --> 04:56.920 align:middle line:84%
All right, so it's going.

121
04:56.920 --> 04:58.700 align:middle line:84%
Let's go back to our client.

122
04:58.700 --> 05:01.470 align:middle line:90%
So let me just do
an IP DHCP again
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:58.700 --> 05:01.470 align:middle line:90%
So let me just do
an IP DHCP again

123
05:01.470 --> 05:03.620 align:middle line:90%
so we can see that
traffic on the capture.

124
05:03.620 --> 05:08.685 align:middle line:90%
And let's go to device, here we
go, 300 dash 1 on the left hand

125
05:08.685 --> 05:09.560 align:middle line:84%
side of the topology.

126
05:09.560 --> 05:12.620 align:middle line:90%
Its IP address is
10, 100, 0, 53.

127
05:12.620 --> 05:16.250 align:middle line:90%
We should be able to reach that
from the roamer on the right.

128
05:16.250 --> 05:22.040 align:middle line:90%
So we'll do a ping, of
10.100.0.53, and that works.

129
05:22.040 --> 05:23.690 align:middle line:90%
And what we should
not be able to hit

130
05:23.690 --> 05:26.150 align:middle line:90%
is we should not be able
to hit anybody who's

131
05:26.150 --> 05:30.560 align:middle line:90%
in the secondary VLAN of 200 or
anybody that's in the isolated
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
05:26.150 --> 05:30.560 align:middle line:90%
in the secondary VLAN of 200 or
anybody that's in the isolated

132
05:30.560 --> 05:32.398 align:middle line:84%
secondary VLAN of 400.

133
05:32.398 --> 05:33.690 align:middle line:84%
And we could test that as well.

134
05:33.690 --> 05:36.410 align:middle line:90%
If we go to a device that's
in the secondary VLAN of 200

135
05:36.410 --> 05:38.990 align:middle line:90%
on the other side, this
is 200 dash 1 on the PC,

136
05:38.990 --> 05:42.920 align:middle line:90%
we'll do a show IP, his IP
address is this right here.

137
05:42.920 --> 05:43.850 align:middle line:84%
I'll just copy that.

138
05:43.850 --> 05:48.440 align:middle line:90%
And from the roamer PC, we'll
do a ping and paste that in.

139
05:48.440 --> 05:51.500 align:middle line:90%
And because it's in a
different community VLAN,

140
05:51.500 --> 05:53.090 align:middle line:90%
we should not be
able to reach it.

141
05:53.090 --> 05:55.082 align:middle line:90%
And the benefit of
capturing all that is we

142
05:55.082 --> 05:56.540 align:middle line:90%
can now look at
the packet captures

143
05:56.540 --> 05:59.690 align:middle line:90%
for the traffic that did work
and see exactly what happened.

144
05:59.690 --> 06:01.790 align:middle line:90%
So I'm going to go ahead
and stop the capture
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
05:59.690 --> 06:01.790 align:middle line:90%
So I'm going to go ahead
and stop the capture

145
06:01.790 --> 06:03.620 align:middle line:90%
and make this a
little bit bigger.

146
06:03.620 --> 06:06.380 align:middle line:90%
And there's a whole bunch
of spanning tree going on.

147
06:06.380 --> 06:10.520 align:middle line:90%
But here's our DHCP, and if
we take a look at the 802.1Q

148
06:10.520 --> 06:14.190 align:middle line:90%
header, it's showing that the
VLAN it came from was the VLAN

149
06:14.190 --> 06:15.350 align:middle line:84%
ID of 300.

150
06:15.350 --> 06:18.980 align:middle line:90%
And then the offer came
back from 10.100.0.1,

151
06:18.980 --> 06:20.810 align:middle line:84%
this switch 1 the DHCP server.

152
06:20.810 --> 06:22.310 align:middle line:90%
And look at this,
the reply traffic,

153
06:22.310 --> 06:23.685 align:middle line:90%
I'm really glad
I looked at this.

154
06:23.685 --> 06:25.340 align:middle line:90%
This is the switched
virtual interface,

155
06:25.340 --> 06:28.460 align:middle line:90%
who's responsible for
handing out the IP addresses.

156
06:28.460 --> 06:31.460 align:middle line:90%
And it's associated with
the primary VLAN of 100.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
06:28.460 --> 06:31.460 align:middle line:90%
And it's associated with
the primary VLAN of 100.

157
06:31.460 --> 06:34.280 align:middle line:90%
And so then we have the client
here who made the request,

158
06:34.280 --> 06:37.940 align:middle line:90%
802.1Q tag of 300, and then we
have the acknowledgment coming

159
06:37.940 --> 06:38.700 align:middle line:84%
back on 100.

160
06:38.700 --> 06:40.700 align:middle line:90%
All right, and then if
we get down to our pings,

161
06:40.700 --> 06:43.100 align:middle line:90%
let me go and do
a filter for ICMP,

162
06:43.100 --> 06:44.990 align:middle line:90%
and here we have
our ping requests.

163
06:44.990 --> 06:47.040 align:middle line:90%
And if we take
the 802.1Q header,

164
06:47.040 --> 06:49.140 align:middle line:90%
it's going to have
300 on the outbound,

165
06:49.140 --> 06:51.140 align:middle line:90%
and it's going to have
300 for the reply,

166
06:51.140 --> 06:54.200 align:middle line:90%
because both those devices, the
roamer on the right hand side

167
06:54.200 --> 06:56.310 align:middle line:90%
of the topology and
the client on the left,

168
06:56.310 --> 06:58.460 align:middle line:90%
which is also in the
secondary VLAN of 300,

169
06:58.460 --> 07:01.130 align:middle line:84%
are both literally in VLAN 300.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
06:58.460 --> 07:01.130 align:middle line:84%
are both literally in VLAN 300.

170
07:01.130 --> 07:04.340 align:middle line:90%
In this video, we verified that
we can extend a private VLAN

171
07:04.340 --> 07:07.460 align:middle line:90%
across multiple switches
over an 802.1Q trunk.

172
07:07.460 --> 07:09.720 align:middle line:90%
Now the trunk itself,
nothing special about that.

173
07:09.720 --> 07:11.060 align:middle line:84%
It's just 802.1Q.

174
07:11.060 --> 07:14.930 align:middle line:90%
It's the configuration of the
private VLANs on both switches

175
07:14.930 --> 07:16.285 align:middle line:84%
that enforces the policy.

176
07:16.285 --> 07:17.910 align:middle line:90%
So thanks for joining
me in this video,

177
07:17.910 --> 07:19.320 align:middle line:90%
and I'll see you
in the next one.

178
07:19.320 --> 07:21.740 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

179
07:21.740 --> 07:25.090 align:middle line:90%
and I'd like to thank
you for viewing.